src/sys/netinet, branch releng/5.3

MFRELENG_5 sys/netinet/tcp_sack.c rev. 1.3.2.10:

2006-02-01T19:43:36Z

Avoid an infinite loop in sack scoreboard processing when the per-hole limits or global scoreboard limits are reached, or when memory exhaustion occurs. This can occur when an existing hole fails to be split due to limits or memory exhaustion. Security: FreeBSD-SA-06:08.sack Approved by: so (cperciva)

Correct bzip2 denial of service and permission race vulnerabilities.

2005-06-29T21:46:15Z

Obtained from: Redhat, Steve Grubb via RedHat Security: CAN-2005-0953, CAN-2005-1260 Security: FreeBSD-SA-05:14.bzip2 Approved by: obrien Correct TCP connection stall denial-of-service vulnerabilities. MFC: rev 1.270 of tcp_input.c, rev 1.25 of tcp_seq.h by ps: When a TCP packets containing a timestamp is received, inadequate checking of sequence numbers is performed, allowing an attacker to artificially increase the internal "recent" timestamp for a connection. A TCP packets with the SYN flag set is accepted for established connections, allowing an attacker to overwrite certain TCP options. Security: CAN-2005-0356, CAN-2005-2068 Security: FreeBSD-SA-05:15.tcp Approved by: so (cperciva)

MFC: Fix two issues which were missed in FreeBSD-SA-05:08.kmem.

2005-05-08T10:23:51Z

Reported by: Uwe Doering Approved by: so (cperciva)

If we are going to

2005-05-06T02:50:35Z

1. Copy a NULL-terminated string into a fixed-length buffer, and 2. copyout that buffer to userland, we really ought to 0. Zero the entire buffer first. Security: FreeBSD-SA-05:08.kmem Approved by: so (cperciva)

Merge tcp_output:1.104 from HEAD to RELENG_5_3:

2004-10-30T20:50:06Z

date: 2004/10/30 12:02:50; author: rwatson; state: Exp; lines: +2 -2 Correct a bug in TCP SACK that could result in wedging of the TCP stack under high load: only set function state to loop and continuing sending if there is no data left to send. RELENG_5_3 candidate. Feet provided: Peter Losher Diagnosed by: Aniel Hartmeier Submitted by: mohan Approved by: re (kensmith)

MFC r1.131:

2004-10-26T17:28:36Z

Check that rt_mask(rt) is non-NULL before dereferencing it, in the RTM_ADD case, thus avoiding a panic. PR: kern/42030 Submitted by: Iasen Kostov Approved by: re@

Merge kern_descrip.c:1.246, uipc_socket.c:1.214, uipc_usrreq.c:1.141,

2004-10-21T09:30:48Z

raw_cb.c:1.30, raw_usrreq.c:1.35, ddp_pcb.c:1.45, atm_socket.c:1.21, ng_btsocket_hci_raw.c:1.16, ng_btsocket_l2cap.c:1.14, ng_btsocket_l2cap_raw.c:1.13, ng_btsocket_rfcomm.c:1.13, in_pcb.c:1.156, tcp_subr.c:1.205, in6_pcb.c:1.61, ipx_pcb.c:1.29, ipx_usrreq.c:1.41, natm.c:1.35, socketvar.h:1.135 from HEAD to RELENG_5_3: Push acquisition of the accept mutex out of sofree() into the caller (sorele()/sotryfree()): - This permits the caller to acquire the accept mutex before the socket mutex, avoiding sofree() having to drop the socket mutex and re-order, which could lead to races permitting more than one thread to enter sofree() after a socket is ready to be free'd. - This also covers clearing of the so_pcb weak socket reference from the protocol to the socket, preventing races in clearing and evaluation of the reference such that sofree() might be called more than once on the same socket. This appears to close a race I was able to easily trigger by repeatedly opening and resetting TCP connections to a host, in which the tcp_close() code called as a result of the RST raced with the close() of the accepted socket in the user process resulting in simultaneous attempts to de-allocate the same socket. The new locking increases the overhead for operations that may potentially free the socket, so we will want to revise the synchronization strategy here as we normalize the reference counting model for sockets. The use of the accept mutex in freeing of sockets that are not listen sockets is primarily motivated by the potential need to remove the socket from the incomplete connection queue on its parent (listen) socket, so cleaning up the reference model here may allow us to substantially weaken the synchronization requirements. RELENG_5_3 candidate. MFC after: 3 days Reviewed by: dwhite Discussed with: gnn, dwhite, green Reported by: Marc UBM Bocklet Reported by: Vlad Approved by: re (scottl)

Merge udp_usrreq.c:1.167 from HEAD to RELENG_5:

2004-10-14T11:49:25Z

date: 2004/10/12 20:03:56; author: rwatson; state: Exp; lines: +3 -3 Don't release the udbinfo lock until after the last use of UDP inpcb in udp_input(), since the udbinfo lock is used to prevent removal of the inpcb while in use (i.e., as a form of reference count) in the in-bound path. RELENG_5 candidate. Approved by: re (scottl)

Merge raw_ip.c:1.145 from HEAD to RELENG_5:

2004-10-14T11:45:26Z

date: 2004/10/12 16:47:25; author: rwatson; state: Exp; lines: +41 -20 When the access control on creating raw sockets was modified so that processes in jail could create raw sockets, additional access control checks were added to raw IP sockets to limit the ways in which those sockets could be used. Specifically, only the socket option IP_HDRINCL was permitted in rip_ctloutput(). Other socket options were protected by a call to suser(). This change was required to prevent processes in a Jail from modifying system properties such as multicast routing and firewall rule sets. However, it also introduced a regression: processes that create a raw socket with root privilege, but then downgraded credential (i.e., a daemon giving up root, or a setuid process switching back to the real uid) could no longer issue other unprivileged generic IP socket option operations, such as IP_TOS, IP_TTL, and the multicast group membership options, which prevented multicast routing daemons (and some other tools) from operating correctly. This change pushes the access control decision down to the granularity of individual socket options, rather than all socket options, on raw IP sockets. When rip_ctloutput() doesn't implement an option, it will now pass the request directly to in_control() without an access control check. This should restore the functionality of the generic IP socket options for raw sockets in the above-described scenarios, which may be confirmed with the ipsockopt regression test. RELENG_5 candidate. Reviewed by: csjp Approved by: re (scottl)

MFC r1.78: further rule verification (against corrupt rules added by root).

2004-10-13T22:07:05Z

Approved by: re